A use‑after‑free bug in Windows Installer causes an authorized local attacker to execute code with elevated privileges. The flaw allows an attacker who can run an MSI package to gain higher system access, potentially compromising the entire machine. The weakness is specified as CWE‑416, which describes memory management errors that lead to arbitrary code execution.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025). Version specificity is not provided in the CNA data, so all listed releases are considered affected.

The CVSS score of 7.0 indicates a high likelihood of serious impact if exploited. The EPSS score is not available, so the current probability of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog. Without external access constraints, the attack vector is inferred to be local; an attacker requires privileged access to initiate the installer and trigger the use‑after‑free. Given the local nature, the threat is significant for insider or compromised credential scenarios.